Got a data breach notice? How to tell if it is legit

Why the sender may be a company you never heard of

Breaches often happen at a vendor: a billing, payroll, benefits or IT company that holds data for the business you deal with. California's list notes that the organization sending the notice may not be the one that was breached. Look for the name of the business you know in the letter; it usually explains the link.

Signs of a fake notice

• It asks you to confirm your password, card number, Social Security number or to pay a fee.
• The link goes to a domain that does not belong to the company or to a known settlement or identity-protection service named in the letter.
• It pressures you to act within hours.
• There is no matching notice on the company's site or on a state attorney general list. See the FTC's guide to phishing.

If the notice is real: what to do, by what leaked

• Social Security number: freeze your credit at all three bureaus (Equifax, Experian, TransUnion); it is free. Then get an IRS Identity Protection PIN so nobody can file a tax return in your name.
• Password: change it on that site and anywhere you reused it, and turn on two-step sign-in.
• Card or bank number: tell your bank and watch statements; ask for a new card if the bank recommends it.
• Medical or insurance details: read the explanation-of-benefits statements from your insurer for care you did not get.
• Use the step-by-step plan at IdentityTheft.gov for your data type.

Keep the letter

If a class action settles later, the notice is often how you show you are in the class. Check our open settlements and the lawsuits filed over breaches, and tell us about a notice that is not listed.